Hey, I included those on the latest snapshot. I did a few changes so I would like you to take a look:
-Modified the use of <match> to <id> -Simplified the decoder to only extract the id, since we were not using the other information -Changed the ids to be in the 6300-6399 range (assigned now for MS DHCP) -Changed the levels from some informative rules to 0 (like ip assigned, etc). Can you test? Anyone here using ms dhcp to try it out? Link: http://ossec.net/files/snapshots/ossec-hids-090528.tar.gz Thanks, -- Daniel B. Cid dcid ( at ) ossec.net On Wed, May 13, 2009 at 1:01 AM, phish phreek <[email protected]> wrote: > Here is the latest and *hopefully* final version. I've created three > separate decoders for Windows DHCP server. One for Windows 2003 IPv4, one > for Windows 2008 IPv4 and the last one for Windows 2008 IPv6. I'm not using > IPv6, so I could only test a few log entries against the decoder. If someone > is using 2K8 IPv6 and you can send me more logs, I'd be happy to test. Also, > I'm pretty new to writing rules in regular expression. If you look at my > decoders and think "WTF!", please let me know what I could do to make it > better. ;) > > I've moved my decoders from decoder.xml to local_decoder.xml as was > recommended on the mailing list. > > I've updated the ms_dhcp_rules.xml file to include 2 new rules from 2008 > IPv4 as well as a separate section for 2008 IPv6 rules. I've changed them > from the 12200/12300 range to 120200 for 2k3/2k8 IPv4 and 120300 for 2k8 > IPv6. I also updated the alert levels to a little more reasonable level and > I've changed the groups to match predefined groups when applicable. > > The decoders also fixed a "bug" when trying to filter out the MAC address or > "extra data". In the last decoder I posted, it didn't always get it right. > > If you've followed my previous instructions, please remove the decoder from > your OSSEC server's decoder.xml file and use the attached local_decoder.xml. > If you're already using a local_decoder.xml file, then don't overwrite your > copy with mine! Copy and paste the contents of mine into yours... Otherwise, > the rest of the previous instructions still apply. > > I'm still working out some possible bugs with the OSSEC agent monitoring the > Windows logs. When I told the agent to monitor > c:\windows\system32\dhcp\*.log it stopped monitoring on Sunday at Midnight. > I'm not sure if that was due to timestamps not being updated or not. I've > since added an entry in the OSSEC agent's ossec.conf file for each day's log > and we'll see if that works better. > > Will the dev team take notice of this on the list and decide if they want to > include it in their project or do I need to send it elsewhere? >
